CLIAMS:1. A method for load distribution among a plurality of authentication authorization accounting (AAA) servers within a network, comprising:
determining, by a network access server, costs for routing a user’s authentication request message to each of the plurality of AAA servers within the network, respectively, upon receiving an access request from a user;
selecting, by the network access server, an AAA server from the plurality of AAA servers within the network based on the costs; and
distributing, by the network access server, the user’s authentication request message to the selected AAA server.

2. The method as claimed in claim 1, wherein the selecting, by the network access server, the AAA server from the plurality of AAA servers within the network based on the costs comprises:
selecting, from the plurality of AAA servers within the network, an AAA server corresponding to a minimal cost.

3. The method as claimed in claim 1, wherein the selecting, by the network access server, the AAA server from the plurality of AAA servers within the network based on the costs comprises:
ranking the plurality of AAA servers within the network in the order of increasing costs, and selecting top N AAA servers with lower cost, wherein N is a preset integer; and
the distributing, by the network access server, the user’s authentication request message to the selected AAA server comprises:
distributing the user’s authentication request message to one of the selected N AAA servers according to a preset load balancing algorithm.

4. The method as claimed in claim 1, wherein the selecting, by the network access server, the AAA server from the plurality of AAA servers within the network based on the costs comprises:
ranking the plurality of AAA servers within the network in the order of increasing costs; and
selecting, from top N AAA servers, AAA servers corresponding to links with cost within a range of (X + 1) times a minimal routing cost, wherein N is a preset integer, X is a preset value; and
the distributing, by the network access server, the user’s authentication request message to the selected AAA server comprises:
distributing the user’s authentication request message to one of the selected AAA servers according to a preset load balancing algorithm.

5. The method as claimed in claim 1, wherein the selecting, by the network access server, the AAA server from the plurality of servers within the network based on the costs comprises:
selecting, from the plurality of AAA servers within the network, AAA servers corresponding to costs within a range of (X + 1) times a minimal routing cost, wherein X is a preset value; and
the distributing, by the network access server, the user’s authentication request message to the selected AAA server comprises:
distributing the user’s authentication request message to one of the selected AAA servers according to a preset load balancing algorithm.

6. An apparatus for load distribution among a plurality of authentication authorization accounting (AAA) servers within a network, comprising:
a cost determination module, configured to determine costs for routing a user’s authentication request message to each of the plurality of AAA servers within the network, respectively, upon receiving an access request from a user;
a server selection module, configured to select an AAA server from the plurality of AAA servers within the network based on the costs; and
a load distribution module, configured to distribute the user’s authentication request message to the selected AAA server.

7. The apparatus as claimed in claim 6, wherein the server selection module is configured to select, from the plurality of AAA servers within the network, an AAA server corresponding to a minimal cost.

8. The apparatus as claimed in claim 6, wherein the server selection module is configured to rank the plurality of AAA servers within the network in the order of increasing costs, and select top N AAA servers with lower cost, wherein N is a preset integer; and
the load distribution module is configured to distribute the user’s authentication request message to one of the selected N AAA servers according to a preset load balancing algorithm.

9. The apparatus as claimed in claim 6, wherein the server selection module is configured to rank the plurality of AAA servers within the network in the order of increasing costs, and select, from top N AAA servers, AAA servers corresponding to links with cost within a range of (X + 1) times a minimal routing cost, wherein N is a preset integer, X is a preset value; and
the load distribution module is configured to distribute the user’s authentication request message to one of the selected AAA servers according to a preset load balancing algorithm.

10. The apparatus as claimed in claim 6, wherein the server selection module is configured to select, from the plurality of AAA servers within the network, AAA servers corresponding to costs within a range of (X + 1) times a minimal routing cost, wherein X is a preset value; and
the load distribution module is configured to distribute the user’s authentication request message to one of the selected AAA servers according to a preset load balancing algorithm.

11. A network access server, comprising:
a processor and a memory coupled to the processor;
wherein the processor is configured to:
determine costs for routing a user’s authentication request message to each of the plurality of authentication authorization accounting (AAA) servers within a network, respectively, upon receiving an access request from a user;
select an AAA server from the plurality of AAA servers within the network based on the costs; and
distribute the user’s authentication request message to the selected AAA server.

12. The network access server as claimed in claim 11, wherein in the step of the selecting the AAA server from the plurality of AAA servers within the network based on the costs, the processor is specifically configured to:
select, from the plurality of AAA servers within the network, an AAA server corresponding to a minimal cost.

13. The network access server as claimed in claim 11, wherein in the step of the selecting the AAA server from the plurality of AAA servers within the network based on the costs, the processor is specifically configured to:
rank the plurality of AAA servers within the network in the order of increasing costs, and select top N AAA servers with lower cost, wherein N is a preset integer; and
in the step of the distributing the user’s authentication request message to the selected AAA server, the processor is specifically configured to:
distribute the user’s authentication request message to one of the selected N AAA servers according to a preset load balancing algorithm.

14. The network access server as claimed in claim 11, wherein in the step of the selecting the AAA server from the plurality of AAA servers within the network based on the costs, the processor is specifically configured to:
rank the plurality of AAA servers within the network in the order of increasing costs; and select, from top N AAA servers, AAA servers corresponding to links with cost within a range of (X + 1) times a minimal routing cost, wherein N is a preset integer, X is a preset value; and
in the step of the distributing the user’s authentication request message to the selected AAA server, the processor is specifically configured to:
distribute the user’s authentication request message to one of the selected AAA servers according to a preset load balancing algorithm.

15. The network access server as claimed in claim 11, wherein in the step of the selecting the AAA server from the plurality of AAA servers within the network based on the costs, the processor is specifically configured to:
select, from the plurality of AAA servers within the network, AAA servers corresponding to costs within a range of (X + 1) times a minimal routing cost, wherein X is a preset value; and
in the step of the distributing the user’s authentication request message to the selected AAA server, the processor is specifically configured to:
distribute the user’s authentication request message to one of the selected AAA servers according to a preset load balancing algorithm.
,TagSPECI:TECHNICAL FIELD

The present invention relate to the field of communication technologies and, in particular, to a method and an apparatus for load distribution among a plurality of authentication authorization accounting (AAA) servers within a network.

BACKGROUND

With the development of the Internet technology, communication requirements extend from traditional low-speed services such as telephone, fax, and telegram to high-speed broadband services such as Internet access, videophone, and video on demand. Users demand higher and higher Internet access rates, and the low-speed Internet access mode of the traditional dialup modem can hardly meet user requirements.

Meanwhile, more and more users access a metropolitan area network and, therefore, the users’ service requirements are expanding, and broadband metropolitan area networks have a tendency of developing into a multi-service bearer network. A Broadband Remote Access Server (BRAS) has flexible access authentication, efficient address management function, and powerful user management function, and can provide rich and flexible service and control functions. Therefore, the BRAS can effectively manage and control user devices accessing the broadband metropolitan area network and services used by the users.

An Authentication Authorization Accounting (AAA) server provides the functions of authentication, authorization, and accounting for the users. The AAA server of the user may be implemented through various protocols, and the most commonly used protocol is Remote Authentication Dial In User Service (RADIUS). The RADIUS protocol is an application layer communication protocol between the BRAS and the AAA server, and an AAA server based on the RADIUS protocol is called a RADIUS server.

Multiple RADIUS servers are generally deployed in a network for reliability and/or load sharing. On one side, each RADIUS server can perform authentication, authorization and accounting for any user and, on the other hand, each RADIUS server can perform access authentication for users of multiple BRASs.

In the prior art, load distribution among multiple RADIUS servers is primarily realized by configuring command lines. For example, if two RADIUS servers are available in the network, one RADIUS server would be configured as the primary server, the other RADIUS server would be configured as the secondary server, and thus a request from a RADIUS client normally will be sent to the primary server, and only when the primary server goes down, will the request be sent to the secondary server. In another example, if two RADIUS servers are available in the network, requests from RADIUS clients are sent to the two RADIUS servers in turn.

However, the above static configuration will lead to improper load distribution when the network topology is changed.

SUMMARY

Embodiments of the present invention provide a method and an apparatus for load distribution among a plurality of authentication authorization accounting servers within a network.

A first aspect of the present invention provides a method for load distribution among a plurality of AAA servers within a network, the method includes:

determining, by a network access server, costs for routing the user’s authentication request message to each of the plurality of AAA servers within the network, respectively, upon receiving an access authentication request from a user;

selecting, by the network access server, an AAA server from the plurality of AAA servers within the network based on the costs; and

distributing, by the network access server, the user’s authentication request message to the selected AAA server.

In a first implementation of the first aspect of the present invention, the selecting, by the network access server, the AAA server from the plurality of AAA servers within the network based on the costs includes:

selecting, from the plurality of AAA servers within the network, an AAA server corresponding to a minimal cost.

In a second implementation of the first aspect of the present invention, the selecting, by the network access server, the AAA server from the plurality of AAA servers within the network based on the costs includes:

ranking the plurality of AAA servers within the network in the order of increasing costs, and selecting top N AAA servers with lower cost, wherein N is a preset integer; and

the distributing, by the network access server, the user’s authentication request message to the selected AAA server includes:

distributing the user’s authentication request message to one of the selected N AAA servers according to a preset load balancing algorithm.

In a third implementation of the first aspect of the present invention, the selecting, by the network access server, the AAA server from the plurality of AAA servers within the network based on the costs includes:

ranking the plurality of AAA servers within the network in the order of increasing costs; and
selecting, from top N AAA servers, AAA servers corresponding to links with cost within a range of (X + 1) times a minimal routing cost, where N is a preset integer, X is a preset value; and

the distributing, by the network access server, the user’s authentication request message to the selected AAA server includes:

distributing the user’s authentication request message to one of the selected AAA servers according to a preset load balancing algorithm.

In a fourth implementation of the first aspect of the present invention, the selecting, by the network access server, the AAA server from the plurality of AAA servers within the network based on the costs includes:

selecting, from the plurality of AAA servers within the network, AAA servers corresponding to costs within a range of (X + 1) times a minimal routing cost, where X is a preset value; and

the distributing, by the network access server, the user’s authentication request message to the selected AAA server includes:

distributing the user’s authentication request message to one of the selected AAA servers according to a preset load balancing algorithm.

A second aspect of the present invention provides an apparatus for load distribution among a plurality of AAA servers within a network, including:

a cost determination module, configured to determine costs for routing the user’s authentication request message to each of the plurality of AAA servers within the network, respectively, upon receiving an access request from a user;

a server selection module, configured to select an AAA server from the plurality of AAA servers within the network based on the costs; and

a load distribution module, configured to distribute the user’s authentication request message to the selected AAA server.

In a first implementation of the second aspect of the present invention, the server selection module is configured to select, from the plurality of AAA servers within the network, an AAA server corresponding to a minimal cost.

In a second implementation of the second aspect of the present invention, the server selection module is configured to rank the plurality of AAA servers within the network in the order of increasing costs, and select top N AAA servers with lower cost, where N is a preset integer; and

the load distribution module is configured to distribute the user’s authentication request message to one of the selected N AAA servers according to a preset load balancing algorithm.

In a third implementation of the second aspect of the present invention, the server selection module is configured to rank the plurality of AAA servers within the network in the order of increasing costs, and select, from top N AAA servers, AAA servers corresponding to links with cost within a range of (X + 1) times a minimal routing cost, where N is a preset integer, X is a preset value; and

the load distribution module is configured to distribute the user’s authentication request message to one of the selected AAA servers according to a preset load balancing algorithm.

In a fourth implementation of the second aspect of the present invention, the server selection module is configured to select, from the plurality of AAA servers within the network, AAA servers corresponding to costs within a range of (X + 1) times a minimal routing cost, where X is a preset value; and

the load distribution module is configured to distribute the user’s authentication request message to one of the selected AAA servers according to a preset load balancing algorithm.

A third aspect of the present invention provides a network access server, including:

a processor and a memory coupled to the processor;

where the processor is configured to:

determine costs for routing a user’s authentication request message to each of the plurality of AAA servers within a network, respectively, upon receiving an access request from a user;

select an AAA server from the plurality of AAA servers within the network based on the costs; and

distribute the user’s authentication request message to the selected AAA server.

In a first implementation of the third aspect of the present invention, in the step of the selecting the AAA server from the plurality of AAA servers within the network based on the costs, the processor is specifically configured to:

select, from the plurality of AAA servers within the network, an AAA server corresponding to a minimal cost.

In a second implementation of the third aspect of the present invention, in the step of the selecting the AAA server from the plurality of AAA servers within the network based on the costs, the processor is specifically configured to:

rank the plurality of AAA servers within the network in the order of increasing costs, and select top N AAA servers with lower cost, where N is a preset integer; and

in the step of the distributing the user’s authentication request message to the selected AAA server, the processor is specifically configured to:

distribute the user’s authentication request message to one of the selected N AAA servers according to a preset load balancing algorithm.

In a third implementation of the third aspect of the present invention, in the step of the selecting the AAA server from the plurality of AAA servers within the network based on the costs, the processor is specifically configured to:

rank the plurality of AAA servers within the network in the order of increasing costs; and select, from top N AAA servers, AAA servers corresponding to links with cost within a range of (X + 1) times a minimal routing cost, where N is a preset integer, X is a preset value; and

in the step of the distributing the user’s authentication request message to the selected AAA server, the processor is specifically configured to:

distribute the user’s authentication request message to one of the selected AAA servers according to a preset load balancing algorithm.

In a fourth implementation of the third aspect of the present invention, in the step of the selecting the AAA server from the plurality of AAA servers within the network based on the costs, the processor is specifically configured to:

select, from the plurality of AAA servers within the network, AAA servers corresponding to costs within a range of (X + 1) times a minimal routing cost, where X is a preset value; and

in the step of the distributing the user’s authentication request message to the selected AAA server, the processor is specifically configured to:

distribute the user’s authentication request message to one of the selected AAA servers according to a preset load balancing algorithm.

A fourth aspect of the present invention provides a non-transitory computer readable storage medium, comprising computer program codes which when executed by a computer processor cause the compute processor to execute the method for debugging application program, including:

determining costs for routing a user’s authentication request message to each of the plurality of AAA servers within the network, respectively, upon receiving an access request from a user;

selecting an AAA server from the plurality of AAA servers within the network based on the costs; and

distributing the user’s authentication request message to the selected AAA server.

As can be known from the technical solutions according to the above embodiments of the present invention, after receiving an access request from a user, the network access server determines routing costs for each path between the user and each server of the plurality of AAA servers within a network, respectively. The network access server selects a server serving for the user from the plurality of AAA servers based on the determined routing cost. Since the server selection is dynamically determined based on routing cost, the server selection can adapt itself to the network topology. Therefore, the configuration of load distribution would be modified dynamically when the network topology is changed, and it is thereby ensured that the load can be distributed to AAA servers in the network properly even if the network topology is changed.

BRIEF DESCRIPTION OF THE ACCOMPANYING DRAWINGS

To describe the technical solutions in embodiments of the present invention or in the prior art more clearly, the following briefly introduces the accompanying drawings needed for describing the embodiments or the prior art. Apparently, the accompanying drawings in the following description illustrate merely some embodiments of the present invention, and persons of ordinary skill in the art may still derive other drawings from these accompanying drawings without creative effort.

FIG. 1 is a schematic flowchart of a method for load distribution among a plurality of AAA servers within a network according to an embodiment of the present invention;

FIG. 2 is a schematic flowchart of another method for load distribution among a plurality of AAA servers within a network according to an embodiment of the present invention;

FIG. 3 is a schematic flowchart of another method for load distribution among a plurality of AAA servers within a network according to an embodiment of the present invention;

FIG. 4 is a schematic flowchart of another method for load distribution among a plurality of AAA servers within a network according to an embodiment of the present invention;

FIG. 5 is a schematic structure diagram of an exemplary network topology;

FIG. 6 is a schematic structure diagram of another exemplary network topology;

FIG. 7 is a schematic structure diagram of an apparatus for load distribution among a plurality of AAA servers within a network according to an embodiment of the present invention;

FIG. 8 is a schematic structure diagram of a network access server according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE EMBODIMENTS

To make the objectives, technical solutions, and advantages of embodiments of the present invention clearer, the following clearly and comprehensively describes the technical solutions in embodiments of the present invention with reference to the accompanying drawings in embodiments of the present invention. Apparently, the described embodiments are merely a part rather than all embodiments of the present invention. All other embodiments obtained by persons of ordinary skill in the art based on embodiments of the present invention without creative effort shall fall within the protection scope of the present invention.

FIG. 1 is a schematic flowchart of a method for load distribution among a plurality of authentication authorization accounting (AAA) servers within a network according to an embodiment of the present invention. As shown in FIG. 1, the method includes the following steps:

S101: A network access server determines costs for routing a user’s authentication request message to each AAA server within the network, respectively, upon receiving an access request from a user.

The plurality of AAA servers may be communicatively connected with the network access server, and the load distribution from a client to the plurality of AAA servers is performed by the network access server. After receiving an access request from the user, the network access server sends the user's authentication request message to one of the plurality of AAA servers upon determination of the cost.

Specifically, the network access server has a routing table that correlates identifiers of individual devices to network paths that can be used to reach that device and contains information about routing costs associated with various network paths. In this embodiment, the routing cost in the routing table can be calculated according to the round trip time for communications between the network access server and an AAA server, or according to the length of paths between the network access server and the AAA servers, and also can be calculated according to the amount of the devices such as routers included in the paths between the network access server and the AAA servers.

In this embodiment, a routing cost calculating algorithm may be preset in the network access server, and the network access server calculates routing cost for each path from the client to the plurality of AAA servers and, in particular, from the network access server to the plurality of AAA servers, according to the routing cost calculating algorithm. Specifically, a routing cost is generally determined as the sum of the cost values for all links in the path. The routing cost may be used to reflect the length of paths, or may be used to reflect time cost for routing messages from an egress node to a destination node through paths. The length of a path can be determined by calculating the number of devices such as routers operationally connected in series to an AAA server in the path. The time cost can be determined by calculating the time for routing a user's authentication request message to an AAA server via various paths. When the path with minimal path length is different than the path with minimal time cost, priority can be given to either the path length or the time cost. In determination of the cost, each device such as router and server in a path can be given an equal cost value. Alternatively, different routers or different servers, or other devices in a path can be given different or weighted cost values based on the factors of traffic load, preferred (or not preferred) usage of certain devices, and so on, in this case, a path with the shortest length does not necessarily have the lowest or minimal cost. The determination of routing cost involves determining the costs of all paths from the user or the network access server to an AAA server, and determining the routing costs from the user or the network access server to each AAA server.

Every time when the network access server detects changing of network topology such as adding a new router or server, or removing an existing router or server, the network access server re-calculates routing costs associated with paths and updates the routing table according to the re-calculated routing costs. When the network access server receives an access request from the user, the network access server reads the routing costs from the routing table. When there are multiple paths from the user or the network access server to the same AAA server, the path with the minimal cost is taken, and the minimal cost among the multiple costs for routing the user’s authentication request message to the same AAA server is deemed as the cost for routing the user’s authentication request message to the AAA server.

For example, in a network with seven AAA servers in the network, that is, a server A, a server B, a server C, a server D, a server E, a server F and a server G, if different routing costs associated with two network paths from the network access server to the server A are read from the routing table, for example, 210 and 270 (here smaller number represents lower cost), the minimal cost for routing the user’s authentication request message to the server A is determined as 210. Table 1 shows an example of results of determining, by the network access server, minimal costs for routing a user’s authentication request message to each AAA server. Based on Table 1, routing a user’s authentication request message to AAA server B has the minimal cost among servers A, B, C, D, E, F, and G.

Table 1
AAA server A B C D E F G
Determined cost 210 200 300 230 310 400 500

The determining of routing cost of embodiments of the present invention is not limited herein, and the network access server may determines costs for routing a user’s authentication request message to each AAA server in other modes. Embodiments of the present invention do not restrict how the network access server determines routing cost.

S102: The network access server selects an AAA server from the plurality of AAA servers within the network based on the costs;

In this embodiment, after determining costs for routing the user’s authentication request message to AAA servers, the network access server selects one of the AAA servers as the AAA server used to receive the current user’s authentication request message.

Specifically, a cost-based server selection algorithm may be preset in the network access server, and the network access server selects the AAA server used to receive the current user’s authentication request message according to the cost-based server selection algorithm and the costs determined in Step 101.

For example, the network access server may select an AAA server corresponding to a minimal cost. According to the determined cost as shown in Table 1, the network access server may select the server B with the minimal cost to receive the current user’s authentication request message.

The AAA server selection based on routing cost of embodiments of the present invention is not limited herein, and the network access server may select the AAA server according to other cost-based server selection algorithm. Embodiments of the present invention do not restrict how the network access server selects the AAA server.

Step 103: The network access server distributes the user’s authentication request message to the selected AAA server.

In embodiments of the present invention, the AAA server may be a Remote Authentication Dial In User Service (RADIUS) server, and the network access server may be a Broadband Remote Access Server (BRAS). However, it shall not be construed as a limitation on the present invention. The AAA server may be any other type of servers having authentication function, authorization function and accounting function, and the network access server may be any other type of access servers suitable for the application of the technical solutions of the present invention. The types of the AAA server and the network access server are not limited to those described in the embodiments.

In the above embodiment of the present invention, after receiving an access request from a user, the network access server determines routing costs for each path between the user and each of the AAA servers within a network, respectively. The network access server selects a server serving the user from the plurality of AAA servers based on the determined routing cost. Since the server selection is dynamically conducted based on routing cost which is timely updated according to the change in network topology, the server selection can adapt itself to the network topology. Therefore, the configuration of load distribution would be modified dynamically when the network topology is changed, and it is thereby ensured that the load can be distributed to AAA servers in the network properly even if the network topology is changed.

In the above embodiment of the present invention, when the routing cost for each path between the user or the network access server and each server of the plurality of AAA servers within the network is calculated according to round trip time for communication between the network access server and AAA servers or according to the length of paths between the network access server and the AAA servers, the network access server can adapt itself to the network to find a server with minimal round trip time or a server with the shortest path length, therefore, the reliability of transmitting packets in the network is improved since the more time a packet travels in a network, the probability of it getting dropped increases. Besides, the traffic of the network can be decreased, and performances of the network can be improved.

FIG. 2 is a schematic flowchart of a method for load distribution among a plurality of authentication authorization accounting (AAA) servers within a network according to another embodiment of the present invention. As shown in FIG. 2, the method includes the following steps:

S201: A network access server determines costs for routing a user’s authentication request message to each AAA server, respectively, upon receiving an access request from a user;

For details about how the network access server determines costs for routing the user’s authentication request message to each AAA server, reference may be made to related contents in the above embodiments of the present invention, which will not be repeated herein.

S202: The network access server ranks the plurality of AAA servers within the network in the order of increasing routing costs for a given user or network access server, and selecting top N AAA servers, wherein N is a preset integer;

Specifically, N is a preset integer higher than 1 and lower than the total amount of the plurality of AAA servers in the network.

For example, N can be selected as 5 in a network with seven AAA servers as shown in Table 1. According to the determined cost as shown in Table 1, the server B is ranked number 1, the server A is ranked number 2, the server D is ranked number 3, the server C is ranked number 4, the server E is ranked number 5, the server F is ranked number 6, the server G is ranked number 7. Therefore, the servers B, A, D, C and E are ranked amongst top 5 and, thus, are selected.

It should be noted that, the value of N can be preset according to requirements and/or based on statistics. For example, if the network’s performance is highly sensitive to routing cost, such as the round trip time for communications between the network access server and an AAA server, a lower value may be configured to N, if the network’s performance is highly sensitive to degree of load balancing, a higher value may be configured to N.

S203: The network access server distributes the user’s authentication request message to one of the selected N AAA servers according to a preset load balancing algorithm, where the preset load balancing algorithm is used to spread user’s authentication request messages among multiple machines.

In this embodiment, a load sharing ratio among the selected N AAA servers may be preset on the network access server. After receiving an access request from the user and determining the selected N AAA servers, the network access server sends the user's authentication request message to the selected N AAA servers according to the preset load sharing ratio. For example, a load sharing ratio among the selected 5 AAA servers is preset as 1:1:1:1:1 on the network access server. In this case, when receiving access requests from 5 users, the network access server sends one user’s authentication request message to one selected AAA server, and sends the following four user’s authentication request messages to the other four selected AAA servers in the order of from lower routing cost to higher routing cost.

The load balancing algorithm of embodiments of the present invention is not limited herein, and the network access server may distribute the user’s authentication request message to one of the selected N AAA servers according to any other preset load balancing algorithm. Embodiments of the present invention do not restrict the load balancing algorithm.

According to the above embodiment of the present invention, load balancing is performed among several AAA servers which are selected based on routing costs, this gives more control in designing the network.

FIG. 3 is a schematic flowchart of another method for load distribution among a plurality of authentication authorization accounting (AAA) servers within a network according to an embodiment of the present invention. As shown in FIG. 3, the method includes the following steps:

S301: A network access server determines costs for routing a user’s authentication request message to each AAA server, respectively, upon receiving an access request from a user;

For details about how the network access server determines costs for routing the user’s authentication request message to each AAA server, reference may be made to related contents in the above embodiments of the present invention, which will not be repeated herein.

S302: The network access server ranks the plurality of AAA servers within the network in the order of increasing costs;

For example, according to the determined cost as shown in Table 1, the server B is ranked number 1, the server A is ranked number 2, the server D is ranked number 3, the server C is ranked number 4, the server E is ranked number 5, the server F is ranked number 6, the server G is ranked number 7.

S303: The network access server selects, from top N AAA servers, the AAA servers corresponding to paths with cost within X difference from minimal routing cost, wherein N is a preset integer, X is a preset value;

Specifically, N is a preset integer higher than 1 and lower than the total amount of the plurality of AAA servers in the network. For example, N can be selected as 5 in a network with seven AAA servers as shown in Table 1. According to the determined cost as shown in Table 1, the servers B, A, D, C and E are ranked amongst top 5. It should be noted that, the value of N can be preset according to requirements and/or based on statistics. For example, if the network’s performance is highly sensitive to routing cost, such as the round trip time for communications between the network access server and an AAA server, a lower value may be assigned to N, if the network’s performance is highly sensitive to load balancing, a higher value may be assigned to N.

Besides, variance X can be used to indicate tolerance of routing cost wasting. More specifically, the variance X may be configured as a percentage, so as to select AAA servers within a certain percentage (i.e., X) difference from the best server in terms of routing cost, and may also be configured as a absolute value, so as to select AAA servers whose routing costs are equal or lower than the sum of the minimal cost and X. For example, X can be configured as 20%. According to the determined cost as shown in Table 1, among the selected AAA servers, i.e., servers B, A, D, C and E, the minimal routing cost is 200, servers B, A and D satisfy that the routing cost is equal or lower than 200+200*20% ( i.e., 240) and, thus, are selected.

It should be noted that, the value of X can also be preset according to requirements and/or based on statistics. For example, if the network’s performance is highly sensitive to routing cost, such as the round trip time for communications between the network access server and an AAA server, a lower value may be assigned to X, if the network’s performance is highly sensitive to load balancing, a higher value may be assigned to X.

S304: The network access server distributes the user’s authentication request message to one of the selected AAA servers according to a preset load balancing algorithm.

For details about how the network access server distributes user’s authentication request messages to the multiple selected AAA servers, reference may be made to related contents in the above embodiment of the present invention, which will not be repeated herein.

According to the above embodiment of the present invention, load balancing is performed among several AAA servers which are selected based on routing costs, this gives more control in designing the network.

FIG. 4 is a schematic flowchart of another method for load distribution among a plurality of authentication authorization accounting (AAA) servers within a network according to an embodiment of the present invention. As shown in FIG. 4, the method includes the following steps:

S401: A network access server determines costs for routing a user’s authentication request message to each AAA server in a network, respectively, upon receiving an access request from a user;

For details about how the network access server determines costs for routing the user’s authentication request message to each AAA server, reference may be made to related contents in the above embodiments of the present invention, which will not be repeated herein.

S402: The network access server selects, from the plurality of AAA servers within the network, the AAA servers corresponding to costs within a range of (X+1) times the minimal routing cost, or X plus the minimal cost, wherein X is a preset value;

Specifically, variance X can used to indicate tolerance of routing cost wasting. More specifically, the variance X may be configured as a percentage, so as to select AAA servers within a certain percentage (i.e., X) difference from the best server in terms of routing cost, and may also be configured as a absolute value, so as to select AAA servers whose routing costs are equal or lower than the sum of the minimal cost and X. For example, X is configured as 20%. According to the determined cost as shown in Table 1, among all the AAA servers in the network, i.e., servers A, B, C, D, E, F and G, the minimal routing cost is 200, and servers A, B and D satisfy that the routing cost is equal or lower than 200*(1+20% ) (i.e., 240) and, thus, are selected.

It should be noted that, the value of X can also be preset according to requirements and/or based on statistics. For example, if the network’s performance is highly sensitive to routing cost, for example, the round trip time for communications between the network access server and an AAA server, a low value may be configured to X, if the network’s performance is highly sensitive to load balancing, a high value may be configured to X.

S403: The network access server distributes the user’s authentication request message to one of the selected AAA servers according to a preset load balancing algorithm.

For details about how the network access server distributes user’s authentication request messages to the multiple selected AAA servers, reference may be made to related contents in the above embodiment of the present invention, which will not be repeated herein.

According to the above embodiment of the present invention, load balancing is performed among several AAA servers which are selected based on routing costs, this gives more control in designing the network.

Further, in the above embodiments of the present invention, the network access server may obtain state information about the AAA servers in the network, and record the obtained state information in the routing table. More specifically, the network access server may send request information to the AAA servers in the network at fixed time or periodically, so as to receive responses carrying the state information from the AAA servers, where the state information may indicate the access state of the AAA server is normal or breakdown, and may also indicate the number of access users managed by the AAA server and the remaining number of access users to be managed by the AAA server.

In this situation, the network access server may performs a pre-filtering among the AAA servers in the network before determining costs for routing a user’s authentication request message to AAA servers. For example, the AAA servers whose access state is breakdown and/or the remaining number of access users to be managed by the AAA server is lower than a preset value, for example, 50, are filtered out. That is, load distribution according to the above embodiments of the present invention is performed among the remaining AAA servers after the pre-filtering.

To make advantages of embodiments of the present invention clearer, the following compares technical effects between embodiments of the present invention and the prior art with reference to two examples.

FIG. 5 is a schematic structure diagram of an exemplary network topology. As shown in FIG. 5, two AAA servers, i.e., AAA server 1 and AAA server 2, are communicatively connected with a network access server 1, where the network access server 1 can send message to AAA server 1 through either the path network access server 1?router 2?AAA server 1 or the path network access server 1?router 1?router 3?router 2?AAA server 1, and the network access server 1 can send message to AAA server 2 through either the path network access server 1?router 2?router 3?AAA 2 or the path network access server 1?router 1?router 3?AAA server 2.

In the prior art, for example, AAA server 1 is statically configured as Primary (or first in a routing table to indicate a higher priority), and AAA server 2 is statically configured as Secondary (or second in the routing table to indicate a lower priority), and it is assume that all links between two devices such as routers have equal cost 1, for example. Under this configuration, if the link “network access server 1?router 2” fails, the network access server 1 will still send user’s authentication request messages to AAA server 1 through the path network access server 1?router 1?router 3?router 2?AAA server 1, and the network access server 1 will send user’s authentication request messages to AAA server 2 only when AAA server 1 goes down. It can be seen that, if load distribution is performed according to a static configuration as above discussed, as soon as the link “network access server 1?router 2” goes down, the cost for routing an user’s authentication request message to AAA server 1 will change from 2 to 4 and, thus, the path is improper since a longer round trip time is required and network congestion and re-transmissions may occur.

As contrast, according to embodiments of the present invention, as soon as the link “network access server 1?router 2” fails, AAA server 2 corresponding to a lower routing cost than AAA server 1 will be selected automatically, that is, the network access server 1 will send user’s authentication request messages to AAA server 2 through the path of network access server 1?router 1?router 3?AAA server 2. The cost for routing a user’s authentication request message to AAA server 2 is 3. It can be seen that, compared with the above static configuration, the network access server can adapt itself to the network to find the best server in terms of routing cost. Therefore, packets travel less in the network and, thus, it will lead to better network utilization and probability of dropping the packet will be reduced.

FIG. 6 is a schematic structure diagram of another exemplary network topology. As shown in FIG. 6, two authentication authorization accounting (AAA) servers, i.e., AAA server 1 and AAA server 2, are communicatively connected with the network access server 1. Initially, routers 1, 2, 3, 4 and 5 are configured in the network, the network access server 1 can send message to AAA server 1 through the path of network access server 1?router 2?router 4?AAA server 1, and the network access server 1 can send message to AAA server 2 through the path of network access server 1?router 2?router 3?router 5?AAA 2. After a period of time, a new router 6 is added into the network, and the network access server 1 can send message to AAA server 2 through the path of network access server 1?router 6?AAA 2.

In the prior art, for example, AAA server 1 is statically configured as Primary (or first in a routing table to indicate a higher priority), and AAA server 2 is statically configured as Secondary (or second in the routing table to indicate a lower priority), and it is assume that all links between two devices have equal cost, for example, 1. If this configuration is not modified manually, even router 6 has been added, the network access server 1 will still send user’s authentication request messages to AAA server 1 through the path of network access server 1?router 2?router 4?AAA server 1, and the network access server 1 will send user’s authentication request messages to AAA server 2 only when AAA server 1 goes down. It can be seen that, if load distribution is conducted according to a static configuration as above, even if a better path is provided when the network topology is changed, the better path may not be utilized unless the static configuration is modified manually. Thus, the load distribution may become improper, longer round trip time may result and network congestion and re-transmissions may occur.

As contrast, according to embodiments of the present invention, as soon as router 6 is added, AAA server 2 corresponding to lower routing cost than AAA server 1 will be selected automatically, that is, the network access server 1 will send user’s authentication request messages to AAA server 2 through the path network access server 1?router 6?AAA server 2. The cost for routing a user’s authentication request message to AAA server 2 is the minimal cost. It can be seen that, compared with the above static configuration, the network access server can adapt itself to the network to find the best server in terms of routing cost. Therefore, packets travel less in the network and, thus, it will lead to better network utilization and probability of dropping the packet will be reduced.

FIG. 7 is a schematic structure diagram of an apparatus for load distribution among a plurality of authentication authorization accounting (AAA) servers within a network according to an embodiment of the present invention. As shown in FIG. 7, the apparatus includes a cost determination module 71, a server selection module 72, and a load distribution module 73, where:

the cost determination module 71 is configured to determine costs for routing a user’s authentication request message to each of the plurality of AAA servers within the network, respectively, upon receiving an access request from a user;

the server selection module 72 is configured to select an AAA server from the plurality of AAA servers within the network based on the costs; and

the load distribution module 73 is configured to distribute the user’s authentication request message to the selected AAA server.

In the above embodiment of the present invention, after receiving an access request from a user, the apparatus for load distribution among a plurality of AAA servers within a network determines routing costs for each path between the user and each of the AAA servers within a network, respectively. Then, the apparatus selects a server serving the user from the plurality of AAA servers based on the determined routing cost. Since the server selection is dynamically conducted based on routing cost which is timely updated according to the change in network topology, the server selection can adapt itself to the network topology. Therefore, the problem that configuration of load distribution should be modified manually when the network topology is changed can be solved, and it is thereby ensured that the load can be distributed to servers in the network properly even if the network topology is changed.

In the above embodiment of the present invention, when the routing cost for each path between the user or the apparatus and each server of the plurality of AAA servers within the network is calculated according to round trip time for communication between the apparatus and AAA servers or according to the length of paths between the apparatus and the AAA servers, the apparatus can adapt itself to the network to find a server with minimal round trip time or a server with the shortest path length, therefore, the reliability of transmitting packets in the network is improved since the more time a packet travels in a network, the probability of it getting dropped increases. Besides, the traffic of the network can be decreased, and performances of the network can be improved.

In further, in another embodiment of the present invention, the server selection module is configured to select, from the plurality of AAA servers within the network, an AAA server corresponding to a minimal cost.

In further, in another embodiment of the present invention, the server selection module is configured to rank the plurality of AAA servers within the network in the order of increasing costs, and select top N AAA servers with lower cost, where N is a preset integer; and

the load distribution module is configured to distribute the user’s authentication request message to one of the selected N AAA servers according to a preset load balancing algorithm.

In further, in another embodiment of the present invention, the server selection module is configured to rank the plurality of AAA servers within the network in the order of increasing costs, and select, from top N AAA servers, AAA servers corresponding to links with cost within a range of (X + 1) times a minimal routing cost, where N is a preset integer, X is a preset value; and

the load distribution module is configured to distribute the user’s authentication request message to one of the selected AAA servers according to a preset load balancing algorithm.

In further, in another embodiment of the present invention, the server selection module is configured to select, from the plurality of AAA servers within the network, AAA servers corresponding to costs within a range of (X + 1) times a minimal routing cost, where X is a preset value; and

the load distribution module is configured to distribute the user’s authentication request message to one of the selected AAA servers according to a preset load balancing algorithm.

According to the above embodiments of the present invention, load balancing is performed among several AAA servers which are selected based on routing costs, this gives more control in designing the network.

FIG. 8 is a schematic structure diagram of a network access server according to an embodiment of the present invention. As shown in FIG. 8, the network access server includes a processor 81 and a memory 82 coupled to the processor 81.

The memory 82 is configured to store program. Specifically, the program can includes program code, the program code includes computer operating instruction.

The processor 81 is configured to determine costs for routing a user’s authentication request message to each of the plurality of authentication authorization accounting (AAA) servers within a network, respectively, upon receiving an access request from a user; select an AAA server from the plurality of AAA servers within the network based on the costs; and distribute the user’s authentication request message to the selected AAA server.

The memory 82 may include a high speed RAM and a non-volatile memory.

The processor 81 may be a Central Processing Unit (CPU), or can be Application Specific Integrated Circuit (ASIC), or can be configured to one or more ASIC.

In the above embodiment of the present invention, after receiving an access request from a user, the network access server determines routing costs for each path between the user and each of the AAA servers within a network, respectively. Then, the network access server selects a server serving the user from the plurality of AAA servers based on the determined routing cost. Since the server selection is dynamically conducted based on routing cost which is timely updated according to the change in network topology, the server selection can adapt itself to the network topology. Therefore, the problem that configuration of load distribution should be modified manually when the network topology is changed can be solved, and it is thereby ensured that the load can be distributed to servers in the network properly even if the network topology is changed.

In the above embodiment of the present invention, when the routing cost for each path between the user or the network access server and each server of the plurality of AAA servers within the network is calculated according to round trip time for communication between the network access server and AAA servers or according to the length of paths between the network access server and the AAA servers, the network access server can adapt itself to the network to find a server with minimal round trip time or a server with the shortest path length, therefore, the reliability of transmitting packets in the network is improved since the more time a packet travels in a network, the probability of it getting dropped increases. Besides, the traffic of the network can be decreased, and performances of the network can be improved.

In further, in the step of the selecting the AAA server from the plurality of AAA servers within the network based on the costs, the processor is specifically configured to:

select, from the plurality of AAA servers within the network, an AAA server corresponding to a minimal cost.

In further, in the step of the selecting the AAA server from the plurality of AAA servers within the network based on the costs, the processor is specifically configured to:

rank the plurality of AAA servers within the network in the order of increasing costs, and select top N AAA servers with lower cost, where N is a preset integer; and

in the step of the distributing the user’s authentication request message to the selected AAA server, the processor is specifically configured to:

distribute the user’s authentication request message to one of the selected N AAA servers according to a preset load balancing algorithm.

In further, in the step of the selecting the AAA server from the plurality of AAA servers within the network based on the costs, the processor is specifically configured to:

rank the plurality of AAA servers within the network in the order of increasing costs; and select, from top N AAA servers, AAA servers corresponding to links with cost within a range of (X + 1) times a minimal routing cost, where N is a preset integer, X is a preset value; and

in the step of the distributing the user’s authentication request message to the selected AAA server, the processor is specifically configured to:

distribute the user’s authentication request message to one of the selected AAA servers according to a preset load balancing algorithm.

In further, in the step of the selecting the AAA server from the plurality of AAA servers within the network based on the costs, the processor is specifically configured to:

select, from the plurality of AAA servers within the network, AAA servers corresponding to costs within a range of (X + 1) times a minimal routing cost, where X is a preset value; and

in the step of the distributing the user’s authentication request message to the selected AAA server, the processor is specifically configured to:

distribute the user’s authentication request message to one of the selected AAA servers according to a preset load balancing algorithm.

According to the above embodiments of the present invention, load balancing is performed among several AAA servers which are selected based on routing costs, this gives more control in designing the network.

In further, as shown in Fig. 8, the network access server may also include a communication interface 83, configured to complete the communication between the network access server and other devices.

As shown in Fig. 8, the network access server may also include a disk 84, configured to store the routing table.

Alternatively, in specific implementation, if the memory 82, the processor 81 the communication interface 83 and the disk 84 can be implemented individually, then the memory 82, the processor 81, the communication interface 83 and the disk 84 can be in communication connection via BUS. The BUS can be Industry Standard Architecture (ISA) BUS, Peripheral Component (PCI) BUS or Extended Industry Standard Architecture (EISA) BUS etc. The BUS can be divided into address BUS, data BUS and control BUS etc. For convenient representation, the BUS is only represented by a single thick line, but does not mean there is only one BUS or one kind of BUS.

Alternatively, in specific implementation, if the memory 82, the processor 81, the communication interface 83 and the disk 84 can be integrated in a single chip, then the memory 82, the processor 81 the communication interface 83 and the disk 84 can be in communication connection via internal interface.

The present invention also provides a non-transitory computer readable storage medium, including computer program codes which when executed by a computer processor cause the compute processor to execute the method for load distribution among a plurality of AAA servers within a network according to embodiments of the present invention.

According to the non-transitory computer readable storage medium, the problem that configuration of load distribution should be modified manually when the network topology is changed can be solved, and it is thereby ensured that the load can be distributed to servers in the network properly even if the network topology is changed.

Besides, when the routing cost for each path between the user or the network access server and each server of the plurality of AAA servers within the network is calculated according to round trip time for communication between the network access server and AAA servers or according to the length of paths between the network access server and the AAA servers, the network access server can adapt itself to the network to find a server with minimal round trip time or a server with the shortest path length, therefore, the reliability of transmitting packets in the network is improved since the more time a packet travels in a network, the probability of it getting dropped increases. Besides, the traffic of the network can be decreased, and performances of the network can be improved.

Persons skilled in the art should understand that all or part of the steps of the methods specified in any embodiment of the present invention may be implemented by a program instructing relevant hardware. The program may be stored in a computer readable storage medium. When the program runs, the program executes the steps of the method specified in any embodiment above. The storage medium may be any medium capable of storing program codes, such as ROM, RAM, magnetic disk, or optical disk.